Hi ,
Thanks for your help.Now i know that it is my GNS3 error.Now i am trying to test with real devices.
But now got another problem.i asked with other topic in this forum. i got 802.1x problem for wired network with NPS. i use auto enrollment certificate with GPO. I use static VLAN in switch.I didn't use dynamic vlan assign in IPS.
Let me can it work because everybody are using dynamic vlan?
But My server didn't recognized my computer as trusted.
my Radius said invilad client request.I think it is my certificate error.
I just want to know ,what kind of subject name will use for certificate ?
i use user certificate template and subject name is PNP.
In Certificate issued to drop drown list of NPS, what kind of certificate do i need to us i need to use local computer certificate or root CA ?.
I am still confuse about this. I think i input wrong information request to create certificate
Because i got below info in NPS event viewer
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/7/2018 2:30:48 AM
Event ID: 6273
Task Category: Network Policy Server
Level: Information
Keywords: Audit Failure
User: N/A
Computer: CA.cadc.local
Description:
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID: CADC\azt
Account Name: azt@cadc.local
Account Domain: CADC
Fully Qualified Account Name: cadc.local/eKiosk/azt
Client Machine:
Security ID: NULL SID
Account Name: -
Fully Qualified Account Name: -
Called Station Identifier: 00-AA-6E-2A-50-0A
Calling Station Identifier: 40-16-7E-45-F2-67
NAS:
NAS IPv4 Address: 192.168.1.101
NAS IPv6 Address: -
NAS Identifier: -
NAS Port-Type: Ethernet
NAS Port: 50110
RADIUS Client:
Client Friendly Name: Cisco Switch
Client IP Address: 192.168.1.101
Authentication Details:
Connection Request Policy Name: Use Windows authentication for all users
Network Policy Name: eKiosk 802.1x
Authentication Provider: Windows
Authentication Server: CA.cadc.local
Authentication Type: PEAP
EAP Type: -
Account Session Identifier: -
Logging Results: Accounting information was written to the local log file.
Reason Code: 265
Reason: The certificate chain was issued by an authority that is not trusted.
<Correlation ActivityID="{A68ECF03-5D8A-0000-4DD0-8EA68A5DD401}" />
<Execution ProcessID="612" ThreadID="4240" />
<Channel>Security</Channel>
<Computer>CA.cadc.local</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-21-3858713045-1423114026-2227573672-1104</Data>
<Data Name="SubjectUserName">azt@cadc.local</Data>
<Data Name="SubjectDomainName">CADC</Data>
<Data Name="FullyQualifiedSubjectUserName">cadc.local/eKiosk/azt</Data>
<Data Name="SubjectMachineSID">S-1-0-0</Data>
<Data Name="SubjectMachineName">-</Data>
<Data Name="FullyQualifiedSubjectMachineName">-</Data>
<Data Name="CalledStationID">00-AA-6E-2A-50-0A</Data>
<Data Name="CallingStationID">40-16-7E-45-F2-67</Data>
<Data Name="NASIPv4Address">192.168.1.101</Data>
<Data Name="NASIPv6Address">-</Data>
<Data Name="NASIdentifier">-</Data>
<Data Name="NASPortType">Ethernet</Data>
<Data Name="NASPort">50110</Data>
<Data Name="ClientName">Cisco Switch</Data>
<Data Name="ClientIPAddress">192.168.1.101</Data>
<Data Name="ProxyPolicyName">Use Windows authentication for all users</Data>
<Data Name="NetworkPolicyName">eKiosk 802.1x</Data>
<Data Name="AuthenticationProvider">Windows</Data>
<Data Name="AuthenticationServer">CA.cadc.local</Data>
<Data Name="AuthenticationType">PEAP</Data>
<Data Name="EAPType">-</Data>
<Data Name="AccountSessionIdentifier">-</Data>
<Data Name="ReasonCode">265</Data>
<Data Name="Reason">The certificate chain was issued by an authority that is not trusted.</Data>
<Data Name="LoggingResult">Accounting information was written to the local log file.</Data>
</EventData>
</Event>
